Dashboards & Visualizations

How to add option "Select All" in a drilldown?

Julia1231
Communicator

Hi,

I add a drildown in a Dashboard.

By this piece of code, I have a list of equipement in the drilldown

|inputlookup lookup.csv |stats count by id
|fields id

Is it possible to add an option "All" like the filter in the Excel?

If yes, how can I do it please?

If no, is there any idea that I can do? Basically  I want to choose 1 single equipement or all equipement.

 

Thanks,

Julia

Labels (2)
0 Karma

gcusello
Esteemed Legend

Hi @Julia1231,

yes, it's possible: you have to add a static option, adding All as label and * as value.

Then, if you like, you can set this value as default for your dropdown.

Something like this:

    <input type="dropdown" token="Status">
      <label>idopen_cases</label>
      <choice value="*">All</choice>
      <prefix>idopen_cases="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>idopen_cases</fieldForLabel>
      <fieldForValue>idopen_cases</fieldForValue>
      <search>
        <query>
          | inputlookup lookup.csv
          | dedup idopen_cases
          | sort idopen_cases
          | table idopen_cases
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>

Ciao.

Giuseppe

0 Karma

Julia1231
Communicator

Hi @gcusello 

I follow your instruction and have this error:

Julia1231_0-1664526304063.png

Do you have any idea please?

0 Karma

gcusello
Esteemed Legend

Hi @Julia1231,

Please share your search and your code.

Ciao.

Giuseppe

0 Karma

Julia1231
Communicator

Hi @gcusello 

Here my script where group1 is the token of the drilldown:

|dbxquery connection="server" query="
SELECT id, time as time_receive, count(*) as count
FROM table
WHERE time < NOW()
GROUP BY id, time_receive "
|lookup lookup.csv numero OUTPUT type
|where type = $group1$
|eval _time=strptime(time_receive,"%Y-%m-%dT%H:%M:%S.%N")
|timechart span=1h count by type

0 Karma

gcusello
Esteemed Legend

Hi @Julia1231,

try using search instead where, and if $group1$ can have a space or a special char inside, use quotes:

| dbxquery connection="server" query="
   SELECT id, time as time_receive, count(*) as count
   FROM table
   WHERE time < NOW()
   GROUP BY id, time_receive "
| lookup lookup.csv numero OUTPUT type
| search type="$group1$"
| eval _time=strptime(time_receive,"%Y-%m-%dT%H:%M:%S.%N")
| timechart span=1h count by type

Anyway, dbxquery is a command to test a connection, it has very low performaces!

Usually DB Connect is used to load data from a DB in a table or a lookup, but not for on line searches, you have a very high respose time!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...